Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
Greetings to all-
First and foremost, I would like to say that I deeply sympathize with all of you who have been plagues by the recent worm that is causing the svchost.exe file to crash, as I too have fallen victim to it. That being said, I'd just like to thank the *COUGH*s who made the worm... for nothing. It's one thing to be a hacker for the greater good, fighting against other hackers, and helping to protect the populace from viruses, etc... But I believe that I'm putting it best when I say that: Hacking for any malicious reason is a childish act of wanting attention, and will never lead to anything other than jailtime, once the law enforcement catches them.
That being said, on with the instructions to fix your PC from the w32.blaster.worm; msblast.exe worm and svchost.exe crashes:
1) End the Trojan process:
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for msblast.exe.
If you find the file, click it, and then click End Process.
Exit the Task Manager2) Deleting msblast.exe:
Click Start.
Click Search, For Files or Folders.
Search for msblast.exe
Once the search is done, delete msblast.exe in the screen to the right.3) Removing changes msblast made to the registry:
Click Start, and then click Run. (The Run dialog box appears.)
Type regedit Then click OK. (The Registry Editor opens.)
Navigate to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value:
"windows auto update"="msblast.exe"
Exit the Registry Editor
Now, for protection from reinfection, go to http://v4.windowsupdate.microsoft.com/en/default.asp and follow the on-screen instructions to install the latest version of Windows, which will prevent the worm from repopulating itself upon your machine.
Sources of interest:
Symantec's W32.blaster.worm Info (including removal instructions for other operating systems):
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.htmlMicrosoft's Security Bulletin, MS03-026:
http://www.microsoft.com/security/security_bulletins/ms03-026.aspMicrosoft Windows updater:
http://v4.windowsupdate.microsoft.com/en/default.asp
Just a little bit more to add:
Don't forget to update your norton antivirus/virus detection software to remove all remnant traces of the blaster worm.
While browsing the forum, I came across a link to symantec's file to do this (I believe this is what it does, I've not yet downloaded/tested it myself)... Thanks goes to http://securityrespo
and Ahmed Sayed (from WinXP forum) for the following links/info...Link to information about Blaster Removal Program:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.htmlHere's a link to download:
http://securityresponse.symantec.com/avcenter/FixBlast.exe
0 
hi, i have the very problem you describe. but i have three more potentially more upsetting ones.....
i followed your advice:-
step 1, task manager automatically closes as soon as i open it
step 2, search for files just won't open
step 3 regedit also closes automatically as soon as you open it.
any advice on what to do next?
much appreciated...
0
Hmmm...
Most likely, your svchost.exe is crashing before you're able to open any of the aforementioned tasks... I'd encountered this with my search for files/folders, but never had it happen with the task manager or regedit. In my opinion, I'd say that your best best is to restart your computer, and attempt to open the tasks before svchost.exe crashes.If that fails, I can give you a short walkthrough for dos in Windows 2000:
Click on Start
Click on Programs->Accessories->Command Prompt.Type the following:
c:\ ---(Going to your harddrive, in this case, C:)
cd Winnt ---(Changing directories)
cd system32 ---(changing directories)dir msblast*.*
---shows if you have the msblast.exe file to delete... If so, type the following:del msblast.exe
At this point, Close the command prompt via EXIT command, or X on the window. Reboot. Attempt to open the aforementioned tasks (search, task manager, regedit).
Hope this helps you out!
0
i just found on
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
a programme which claims to remove the bugger. i downloaded it and ran it and it tells me that it's been successfully removed. wahay!
i hope the link works but i can't copy and paste. my svchost.exe collapsed...........
0
Hi there, I've encountered the same problem but I couldn't find the MSblast.exe file in the task manager. Anyone care to help? Thanks a lot.
0
After downloading the patch for the msblast.exe every time installation is attempted the error message appears "KB823980 Setup Error" with the text saying the computer cannot verify the interity of the patch (from the msn web site) and to make sure the cyrtopgraphic program is running OR that the versions of windows is different from the program being installed. Is this the worm protecting itself? Is there a solution? Thanks.
0
Greetings! In the same boat as everyone but sinking faster! System keeps crashing before winows xp can fully open. any ideas?
0
Howdie.
Same as Jas. Have the same symptoms but searches come up empty for msblast.exe.
Have run fixblast.exe - no worm detected.
Cheers
0
Why would Cut & Paste etc. stop working if svchost.exe is still
on my process table (three times in fact!) and I don't have
MSblaster.I'm running W2K SP3 with the latest MS updates?
0
Hi,
I've got a very similar problem to CeeJay, all the symptoms of the MSBlast worm (cannot use file search, SVChost.exe crashes soon after IE is opened), but the removal tool from symantec runs and says I don't have the worm.
MSBlast.exe is also not in my task manager or in HKEY_LOCAL_MACHINES\....\Run.Hopefully a solution can soon be found to this extreme annoyance.
I'm currently upgrading to service pack 4, but I'm not confident this will help remove the prob.
Thanks
0
Hi all,
I was looking for any mention of the blaster files in my registry via regedit, when I came upon two entries of MSBlaster and blast in the registry:
HKEY_USERS\S-1-5-21-1004336348-484763869-1060284298-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU
As this problem occurs only when I start IE (5.5) this seems quite interesting.
I've deleted the two registry entries and i'm going to delete IE and install IE6. Does that sound like a rational course of action?
Thanks
0
Jumper
I know your pain!
the svchost.exe crash loop that you are experiencing can be cured!
You need to apply a patch (MS03-026) before running the fix detailed in the messages above.The loop is only an issue for Windows XP OS
The patch can be downloaded from:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp
It worked for me, hope it solves your problem.
For more info view the Mcafee site:
http://vil.nai.com/vil/content/v_100547.htm
0
Hi,
The worm is very frustrating!I have the problem where I had the worm and I believe it has messed with the system so that the patch or any Microsoft updates will not work. When I try to install the patch I get the error "KB823980 Setup Error". When I try to run WindowsUpdate, it says that I am not the administrator. Now the WindowsUpdate option has disappeared from my Start menu! On the Microsoft Support site I found some comments on editing the registry (HKEY_CURRENT_USER) but this didn't work.
Anyone have any ideas?
0
Hi to all,
Hi to all,> Got svchost.exe
> Anyone got a shotgun?No, get Bill Gates, and a shootgun !!!
No, your machine should be clean before patching using M$ update tool, because the MSBLAST.exe locks some files replaced by the patch...
And No again, it doesn't loop. On your C: hard drive is another MSBLAST.EXE, names MSBLAST.EXE44545646466546 (MSBLAST.exe + a lot of numbers) -> You'll have to delete this one (XP only). You should search "MSBLAST*.*"
Yet another tip : if you're connecting to the internet, without having a patched system, you can be infected again. due to the security hole in microsoft's TFTP service (corrected by the patch). This may happen typically because you will need to clean before you can connect and download the patch. Another tip : you can easyly stop your system shutting down with the "shutdown -a" command.
Be carefull, microsoft's patch DOESN'T prevent from being infected again. This patch is only usefull because this worm is dedicated to do a massive distributed DoS-attack (the 16th august) on microsoft's web server.
Other infos to read :
-> Fsecure virus description : http://www.f-secure.com/v-descs/msblast.shtml
- "World's First RPC Worm found" : http://www.f-secure.com/news/items/news_2003081200.shtml
0
This is definately the RPC problem. Your machine is under attack from an MBlast infected machine, though not directly infected. Symptoms include Outlook Crashes, IE Crashes, Can't Search for Files and Folders and the RPC Service being stopped. Install the MS Fix to resolve the problem.
kb823980 for Unchecked Buffer in the RPC Service: http://www.microsoft.com/technet/security/bulletin/MS03-026.asp
0
Hi,
I have the svchost.exe error but msblast is not listed in the Task Manager. I tried searching for it using the Search Files option but it's not running.
Can anyone help me?
Thanks!
0
Hi,
I have the svchost.exe error but msblast is not listed in the Task Manager. I tried searching for it using the Search Files option but it's not running.
Can anyone help me?
Thanks!
0
Hi,
I have the svchost.exe error but msblast is not listed in the Task Manager. I tried searching for it using the Search Files option but it's not running.
Can anyone help me?
Thanks!
0
Hi,
I have the svchost.exe error but msblast is not listed in the Task Manager. I tried searching for it using the Search Files option but it's not running.
Can anyone help me?
Thanks!
0
We have several machines here that had the virus. all are now showing clean, with no symptomes, BUT none of them can connect to a MS Exchange server remotely! 3 other companies here are having the identical problem. Any Idea's ??
0
To Patuz:
As mentioned above, the svchost error occurs when your PC is harassed by another PC that is infected (even if your PC is not infected) if you lack the Windows patch for RPC buffer overflow. Get the Windows patch.
0
ok..... i had the same problems.... didnt find the worm with the cleaning tool yadda yadda....
but after i patched it.... i still didnt find worm...
but it seems to be resolved....
get the patch.... its what worked for me ;)
also... about the exchange server problem...
you should just reformat those... the msblast will not infect and files you need to save like documents and stuff... just back up and format... then patch from withing the network and then get em on line... i havent ofund and reason for exchange servers to have that problem....
0
Velluminous,
Thank you so much for your help! Your solution completely cleared up my problem. Was just wondering though - how did you figure it out?
0
This thing is really...really....... really...........Frustrateing!!!!!!
So..here's the deal!I'm Surfing the net trying to figure out how to keep this thing off my system (PERMANTLY!!!) and about every minute or so the stupid thing keeps comeing back and re-installing itself into my computer. I've got the task manger open, the registery editor open, and the command prompt open (just in case it trys to shut-down my computer).
What I need is to find out how to stop msblast from loading itself onto my system....I know how to fix it once i've got it...just don't know how to keep it from coming back.
Also here is a list of several things that are going wrong-
*Microsoft's web site not Loading
*Cut and Paste functions not working
*Some links on the net not working when clicked on (seems to be only the ones related to fixing msblast)Anyone with any help would be great!
thanks -Eli
0
i've been following all the instructions
downloaded lots of fixes and stuff
but no use...i can't find the files (as most of ppl here!) but i keep getting the svchost.exe error message
i guess this is the worst PC problem...
i'll rest for some time and then check the news again.
=====
my problem is:i'm able to install the SP4 (i tryed to find the worm before i install so i can delete it but no luck)
but after installing it and restarting i try to connect but the connection file is removed...when i try to do a new one... i can't complete the making...
is anybody having this problelm
0
Hi All,
Had the same thing.
i was infected with the blaster virus, but Norton cleaned it, and it was removed.
But traces where left apperently.
Svchost.exe crashing all the time, no browsing, no cut and paste, no search etc.
No trace off msblast.exe anywehere anymore.
I was clean.
In a loop trying to install the mircosoft patch, no access to the internet, because of the crash.
Installed Zonealarm while i was offline.
All problems solved.
Because i was being infected again everytime i accessed the internet.
Now Zone Alarm block the lot, and i'm typing happyly the day away again.
Hope this helps.
Wendy
0
http://www.microsoft.com/downloads/search.aspx?displaylang=en
!!!! it's work !!!
I had all the problems, but the msblast.exe wasn't found :(
I runned this and all works!!!
Just run it, and reset!For Windows2000: http://www.microsoft.com/downloads/details.aspx?FamilyID=c8b8a846-f541-4c15-8c9f-220354449117&displaylang=en
For WinXP: http://www.microsoft.com/downloads/details.aspx?FamilyID=c8b8a846-f541-4c15-8c9f-220354449117&displaylang=entip: for searching open any folder and write F3
It's cool to know that after a week you comp can copy, paste and even work!!! :D
0
Hello all,
I've been working on a computer that has been infected for quite a while now. I've downloaded the patch, installed it more than once and more than once ran the symantec fixblast. NONE of this works. PLUS I have worse problems. The only mode that really works is safe mode. In normal mode, it will load the desktop background, but then like completely stop. I open the task manager and there are no virus programs running or any variations. The closest is winlogon.exe which looks like winlogin.exe (virus) but no go. It's also maxing out the computer doing nothing! It says at 100% cpu usage, but normally running it should be at like 4%!! There are multiples of svchost with differing values, what's up with that? I'm lost and about to give up, any suggestions?thanks
0
My computer has been infected by the virus a few days ago and I have been trying to find a cure since then.
I read the comments in this forum and also in other forums, but have been unable to find any solutions.
The most impoortant point where my infection varies from most of the others is that neither fixblast program nor norton amti-virus has been able to find any kind of infection or a virus on my computer.
I have read that other people have had such problems, but no comments have been made as to what mightbethe reason of that or what must be done.
I have tried to install the win2k security patch, the so called ms03-26 or stg. like that but as characteristic to the virus I have been unable to do so.
Right now I'm downloading a free firewal program named "tiny personal firewall" from download.com which is reputed to contain the virus in and thus enabling the installation of the aforementioned security patch.
I am waiting for any and all comments on the subject.
thanks already;
0
I've downloaded the "patch" for Windows 2000, but when I click on it, I'm told I don't have "Service Pack 2". What's that and where do I get it?
0
Can someone please help me?
I have the symptoms all of you have been writing about (and then some). I have done everything including updating virus definitions and downloading the Msblast fix from the symantec website. But it says all well.
Please help!
Symptoms
1. When i connect to the net svchost.exe crashes
2. Then all hell breaks loose
i. Cant copy and paste (i can select the text and copy but the paste option is greyed)
ii. Word doesnt work (when i start up, i get an error that says 'document cant be registered')
iii. I cant save web pages
iv. I cant use the serach icon in windows (i click on it but nothing happens)SOmeone should go to jail for this
aug 17
0
HELLO ALL! PLEASE READ THIS FIX
This is a post to an earlier message i sent about the problems i was having (word doesnt register, no copy and paste, cant save web pages, svchost.exe crash).
after posting it and many hours of frustration i seem (note the word: SEEM!) to have fixed it. I dont know if this works for you all but try it anyways
1. First download the Worm Blaster Fix from Symantec it and run it (chances are it will say no worm found)
2. It then prompts you saying there is a vulnerability and you need to fix it. Click on the link it shows (its a Microsoft link)
3. Download the patch. For those who want to go to it directly note these details
URL: http://www.microsoft.com/downloads/details.aspx?FamilyId=C8B8A846-F541-4C15-8C9F-220354449117&displaylang=en
File: Windows2000-KB823980-x86-ENU.exe
Name: Blaster Worm: Critical Security Patch for Windows 2000
4. Download, install and restart
MY CURRENT SCENARIO: So far no probs (running all my tasks fine since 30 mins). Only apps i have not attempted to run is Yahoo Messenger 5.0 (im too nervous!)
Hope this helps
aug 17
0
Hi all;
I have been fighting(!) this virus for some time now. Though I am beginning to think that I have not been infected in the first place.
The reader may wonder how someone would be fighting a virus which has not yet infected him. Well what led me to such a thought is an article I read at the windows update site.
The article has been written by the microsoft pros so I have my full confidence in it.
İt stated that continuous system craches could still be a result of the virus which has not been able to enter the machine but has been trying to enter the machine through some port.
This also complies with the fact that neither fixblast nor norton av nor pc-cillin have been able to fnd a trace of it on my computer.
So what I did was this:
1- I first downloaded the program "tiny personal firewall" from download.com then set the settings to close the ports as larry from the forum http://www.computing.net/windows2000/wwwboard/forum/50456.html has explained
2- then I downloaded the windows updates.
3- everything is working fine.Don't let it slip your mind that the virushas never been found on my computer. İf ny of the aforementioned programs have detected anything then I guess it should first be cleaned, the machine hardbooted and then tried to be protected against a ny virus attack.
also don't forget to visit the forum 50456 that I mentioned above.
I would be happy to learn if this information has been helpful to anyone.
thamks;
0
I'd just like to say that response no 33 is the way to go, thanks chguy... I run japanese win 2k and it was a total nightmare to get it running again until I read your post.
0
The way to fix this new worm is to download zonealarm and install. the easy way to do this is go to www.google.com and type "download zonealarm". Please email me if this worked for you email me at killerog@aol.com if u want to tell more tips on computer.
0
I have the same issue as stevew81, I downloaded symantec fix, but nothing was found. Search for alllllllllll lnown names as msblast.exe, msblast*.*, and many others listed on symantec and trend sites. But nothing was found, I actually found the msblast in the registry.
NOW NOW I found the new name! It's DLLHOST.exe located under %SystemPath%/System32/wins, wich measures 10kb compared to the 6kb of the original dllhost.exe (see the difference between capital and lower letters also), which also contains a SVCHOST.exe which is actually TFTP.exe!!!! WOW!!! I FOUND A NEW VERSION OF THIS F@#$&$%&/&(ING WORM!
Please confirm my teory and if true spread it. I believe it's a new variant of the worm.
Help, I must agree in something with this worm "Billy, stop making money and FIX THIS S.H.I.T.!"
0
After a clean install of windows the svchost.exe error returned.This lead me to believe an outside source was causing the prob, After installing ZoneAlarm the problem stopped.However, it alerted me to attemps by an infected machine trying to connect to my machine.Zonealarm asked me if i wanted to allow "Services.exe" to run.I told it no.I suspect if i had of said yes the svchost prob would have been back.I found a copy of that DLLHOST.exe on my machine the other day also.
0
All, I've been reading responses to the described above problem (svchost.exe crashing) for past couple of days. However, none of the answers on this website work. I have about 30 servers that I take care of and out of those 30, 2 are having the exact problem - and so is my workstation and laptop.
First, I would like to clarify, that none of my computers (servers and workstations) had the virus to begin with. I installed KB823980 patch because I thought it would be nice to have it before blaster (or its variations) will hit my network. And that was a mistake. KB823980 doesn't do crap. In fact, the only thing that it has done for me, was crashing svchost.exe. The funny thing is, that I can replicate this problem and crash svchost whenever I want - how? just use KB823980Scan tool from MS.
Usage: KB823980Scan
http://support.microsoft.com/default.aspx?scid=kb;en-us;826369
I must say that, unfortunatelly, all the above responses are useless, and please, stop spreading this BS (Msblaster this, msblaster that)...
As far as MS, they just need to get their crap straight, and test patches throughly before releasing them.
0
Finally! the correct answer is here:
http://www.mail-archive.com/bugtraq@securityfocus.com/msg12288.html
0
Some of us possibly infected the WIN32.nanchi!!! look at this:
http://www.geek.com/news/geeknews/2003Aug/gee20030818021348.htm
http://insight.zdnet.co.uk/internet/security/0,39020457,39115823,00.htm
Good lack!
0
I experienced the problems you mentioned - AVG antivirus version 6 sorted them out - seemed to be msblaster infection followed by the nachi worm infection - you can download AVG from their website for free. Hope this helps anybody still suffering
0  |
 |
 |
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
